Compare Mullvad and Surfshark on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: ExpressVPN, Private Internet Access
Sweden· VPN Services
Needs review
Shortlist when you need a Swedish founder-owned privacy VPN with numbered accounts, GPL clients, RAM-only relays, and a dense public audit trail. Skip when you need dedicated IPs, remote port forwarding, or productized enterprise SSO/ISO packaging—consider Proton VPN for suite/free-tier onboarding or AirVPN for inbound ports.
Netherlands· VPN Services
Needs review
Shortlist Surfshark when you need unlimited concurrent devices, a large RAM-only commercial VPN network, and optional Surfshark One suite tools under a Dutch legal entity. Skip when you need ownership diversification away from the Nord Security group, open-source clients, cash-only anonymous accounts, or hard EU-only account processing without US-group SaaS — consider Proton VPN or Mullvad instead.
Highlighted rows differ between the two products.
| Feature | Mullvad | Surfshark |
|---|---|---|
| Country of origin | Sweden | Netherlands |
| Category | VPN Services | VPN Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Sweden | Netherlands |
| Legal entity | Mullvad VPN AB (reg. no. 559238-4001); parent Amagicom AB | Surfshark B.V. (Kabelweg 57, 1014BA Amsterdam, the Netherlands) |
| Governing law | Swedish / EU law (GDPR); see Swedish legislation help page | Netherlands / EU GDPR as controller per Privacy Policy |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Multi-region VPN exits (EU and outside EU, including USA) on owned and rented colo (public provider list: e.g. M247, DataPacket, xtom, Zenlayer, Blix). RAM-only VPN OS. Account/payment personal data claimed stored only in EU/EEA. Payment subprocessors include Stripe and PayPal (US-group) plus SEB for bank/Swish when those methods are used; support email self-hosted by Mullvad since 2024. | Global RAM-only VPN server network (vendor: 4,500+ servers / 100+ countries). Account/support/analytics/payments subprocessors per Privacy Policy include Google (Firebase Analytics, BigQuery), Cloudflare, Zendesk, Stripe and other PSPs, AppsFlyer, Iterable, Purchasely, Telnyx, plus group companies in EEA, UK, and the United States. Transfers use SCCs or adequacy. |
| Summary | Swedish privacy VPN with numbered accounts (no email), GPL-3 clients, RAM-only relays, and repeated third-party security audits—built for anonymity over enterprise packaging. | Dutch-registered VPN and Surfshark One cybersecurity suite: unlimited devices, RAM-only servers, audited no-logs claims, and optional antivirus, leak alerts, and identity tools. |
| Tags |
| At a glance | Mullvad | Surfshark |
|---|---|---|
| HQ / entity | Gothenburg, Sweden — Mullvad VPN AB (parent Amagicom AB) | Not listed |
| Ownership | 100% founders Fredrik Stromberg and Daniel Berntsson | Merged holding with Nord Security (2022); brands operate separately |
| Protocols | WireGuard (primary), OpenVPN; bridges/obfuscation | Not listed |
| Clients | GPL-3 apps (Win/macOS/Linux/Android/iOS); WireGuard configs + CLI | Not listed |
| Sessions | Five simultaneous connections; shared exits only | Not listed |
| Commercial model | Prepaid access; no free tier; cash/crypto/card/PayPal (see site) | Not listed |
| Infrastructure | RAM-only VPN relays; multi-region colo (owned + rented) | Not listed |
| Independent audits | Multiple public app/infra audits (Cure53, ROS, Assured, X41, …) | Not listed |
| B2B packaging | Self-serve consumer ToS; no productized enterprise pack found | Not listed |
| HQ / legal entity | Not listed | Surfshark B.V., Amsterdam, Netherlands |
| Deployment | Not listed | Cloud VPN / SaaS suite (not self-hosted) |
| Open source | Not listed | No (closed-source clients) |
| Device model | Not listed | Unlimited simultaneous connections (paid plans) |
| VPN network | Not listed | 4,500+ RAM-only servers, 100+ countries (vendor-stated) |
| Primary audits | Not listed | Deloitte no-logs 2023/2025; Cure53; SecuRing |
| Key capabilities | Mullvad | Surfshark |
|---|---|---|
| EU-operated (Sweden) | Yes | Not listed |
| Numbered accounts | Yes | Not listed |
| GPL-3 clients | Yes | Not listed |
| WireGuard + multihop | Yes | Not listed |
| Public security audits | Yes | Not listed |
| RAM-only relays | Yes | Yes |
| Unlimited devices | Not listed | Yes |
| NL legal entity | Not listed | Yes |
| Deloitte no-logs (claimed) | Not listed | Yes |
| VPN + One suite | Not listed | Yes |
| Closed source | Not listed | Yes |
Numbered accounts (no email required)
Signup generates a random account number with prepaid time remaining—no username, password, or email by default. Multiple people can share a number; recovery without the number is intentionally hard. Best when identity linkage is a risk; use cash or self-hosted crypto payments if you also want to avoid card/PayPal trails.
WireGuard-first apps with multihop and obfuscation
Official clients for Windows, macOS, Linux, Android, and iOS use WireGuard with multihop, quantum-resistant tunnel options, DAITA traffic-analysis resistance, and bridge/obfuscation modes (Shadowsocks, UDP-over-TCP, QUIC, LWO on selected servers) for censored networks. Kill switch and tunnel DNS are on by default. Up to five simultaneous connections per account.
GPL-3 open-source clients
Desktop and mobile client code is published under GPL-3 (github.com/mullvad/mullvadvpn-app) with public audit reports in-repo. WireGuard config export and a CLI support non-GUI deployments. iOS App Store distribution uses Apple's EULA rather than GPL for the shipped binary.
RAM-only relays and public audit trail
VPN infrastructure completed migration to diskless/RAM-only operation so reboots discard volatile state. Multiple independent infrastructure and app assessments (Cure53, Radically Open Security, Assured, X41, and others) publish findings; Cure53's work explicitly looked for privacy-impacting flaws on sample relays.
DAITA and quantum-resistant tunnels
DAITA (Defense Against AI-guided Traffic Analysis) adds padding/cover traffic patterns against modern traffic-analysis models. Quantum-resistant WireGuard tunnel modes are available across platforms and were rolled out as defaults on supported clients—useful for long-lived confidentiality threat models, at some performance cost.
Unlimited simultaneous VPN connections
One subscription covers every concurrent device the account can run — phones, laptops, TVs, routers — without the 5–12 device caps common on rival plans. Best for households and multi-device freelancers; confirm current ToS limits for free trials.
RAM-only global VPN network with modern protocols
Vendor-stated 4,500+ RAM-only servers across 100+ countries; WireGuard, OpenVPN, IKEv2, and in-house Dausos. Nexus features include MultiHop, IP Rotator, Everlink self-healing, and FastTrack routing. Server counts and locations change — verify live map before region-critical use.
Surfshark One security suite (beyond the tunnel)
Optional bundling of antivirus (AV-TEST scored), Alert leak monitoring, Alternative ID (disposable persona/email/number), private Search, and Incogni data-broker removal on higher tiers. Suite tools process extra personal data by design — read the Privacy Policy scopes before enabling them.
Nexus MultiHop, IP Rotator, and CleanWeb
Dynamic MultiHop for entry/exit pairing, periodic IP rotation without full disconnect, CleanWeb ad/tracker blocking, plus kill switch and bypass controls. Useful for privacy-sensitive browsing and shared networks; not a substitute for endpoint hardening on high-risk devices.
Audited no-logs posture and public security tests
Deloitte no-logs assurance reported for 2023 and 2025 (account-gated full reports); public Cure53 and SecuRing assessment PDFs for infrastructure/apps. Treat as strong consumer-grade transparency, not automatic enterprise ISO/SOC coverage.
| Assurance & compliance | Mullvad | Surfshark |
|---|---|---|
| Independent security / no-logs audit | Verified Public Cure53 infrastructure reports (e.g. 2021, 2024) and other third-party app/infra audits; Cure53 stated no PII on assessed systems and no anonymity compromise found in 2024 sample. April 2023 Swedish police search reported no customer data seized. | Vendor claimed Deloitte no-logs assurance reports for 2023 and 2025 (ISAE 3000 framing per vendor; full reports account-gated). Public Cure53 and SecuRing security/infrastructure PDFs also published on Trust Center. |
| ISO 27001 | Not found | Not found Not found as a primary advertised company-wide certification on Trust Center pages reviewed for this draft. |
| SOC 2 / SOC 3 | Not found | Not found Not found as a primary advertised company-wide certification on Trust Center pages reviewed for this draft. |
| GDPR / EU data protection | Vendor claimed Swedish EU entity; privacy policy addresses GDPR rights and states personal data stored/processed only in EU/EEA. | Vendor claimed Dutch B.V. controller; Privacy Policy cites GDPR, DSAR rights, SCCs/adequacy for transfers. Not legal advice. |
| US CLOUD Act exposure (indicative) | Partial EU entity, founder-owned, no known US parent. Partial residual exposure: Stripe and PayPal as payment processors (US-group) when those methods are chosen; multi-region exits include US colo. Not legal advice. | Partial EU entity / no known US parent, but Privacy Policy lists US-group subprocessors (Google analytics/storage, Cloudflare, Zendesk, Stripe, AppsFlyer, Telnyx, US group companies) for account/support/marketing/payments paths. VPN no-logs claims do not eliminate account-data exposure. Indicative only — not legal advice. |
| Data processing agreement (B2B) | Not found Consumer privacy policy and ToS published; no productized enterprise DPA flow found on primary pages. | Not found No clear public self-serve B2B DPA package found on primary pages; Teams is sales/quote-driven. Confirm contract language before enterprise use. |
| EU AI Act | Not applicable VPN connectivity product; not an AI system under typical procurement framing (DAITA is a traffic-defense feature, not a general-purpose AI product). | Not applicable Consumer VPN/security suite; AI-assisted scam-check features exist but product is not AI-centric as primary category. |
| VPN Trust Initiative seal | Not listed | Vendor claimed Vendor displays VTI certification/seal on About and Trust materials; confirm current listing on vpntrust.net if required. |
| Considerations & known limitations | Mullvad | Surfshark |
|---|---|---|
| Consumer packaging, not enterprise control plane | Medium Self-serve numbered accounts without productized SSO/MDM org admin, ISO/SOC claims, or click-through DPA. Procurement that requires those artifacts needs offline negotiation or another vendor. | Not listed |
| US payment processors when card/PayPal used | Medium Stripe and PayPal process identity-bearing payment data outside the pure numbered-account model. Cash or self-hosted crypto reduces that trail; card/PayPal does not. | Not listed |
| Multi-region exit nodes including non-EU | Medium Traffic can leave the tunnel outside the EU depending on server choice. Strict residency policies need operational EU-only exit controls, not HQ branding alone. | Not listed |
| No new port forwarding; no dedicated IP | Low Remote port forwarding was disabled for new ports in 2023; dedicated IPs are not offered by design. Choose AirVPN or self-hosted WireGuard if inbound reachability is required. | Not listed |
| Weak recovery without the account number | Low No email-based reset by default. Losing the number can mean losing access; treat it as a secret in team runbooks. | Not listed |
| US CLOUD Act residual path (indicative) | Low No known US parent. Residual exposure mainly via US payment SaaS and optional US exits—not ownership. Not a guarantee against other LE cooperation. | Not listed |
| Shared holding with Nord Security | Not listed | Medium After the 2022 merger, Surfshark and Nord brands sit under one industry group even if infrastructure is separate. Shortlists that need ownership diversification should not treat NordVPN as an independent alternative. |
| US-group SaaS in account data path | Not listed | Medium Privacy Policy names Google, Cloudflare, Zendesk, Stripe, AppsFlyer, Telnyx and US group companies among recipients. Practical impact: account, support, billing, and marketing data may be reachable via US legal process even when VPN activity is claimed unlogged. |
| Limited public enterprise certs / DPA | Not listed | Medium Strong consumer-facing audit marketing (Deloitte, Cure53, SecuRing) but ISO 27001/SOC 2 and a self-serve DPA were not found on primary pages. Regulated buyers need extra contract and evidence work. |
| Suite features expand personal data processing | Not listed | Low Alert, Alternative ID/number, email scam checker, and Incogni process additional identifiers or content by design. Enabling the full One suite widens the privacy surface beyond pure VPN tunneling. |
| Closed-source client applications | Not listed | Low Clients are not open source; buyers who require public code review of VPN apps should prefer peers with OSS clients. |
When: You need inbound remote port forwarding or Dynamic DNS
Consider: AirVPN
Mullvad disabled new port forwards in 2023; AirVPN remains port-forward oriented.
When: You want a free tier plus mail/drive in one European privacy suite
Consider: Proton VPN
Proton is account-based with a broader product suite; Mullvad optimizes for minimal identity.
When: You need maximum consumer server footprint and streaming-oriented features
Consider: NordVPN or Surfshark
Trade a denser feature catalog for weaker accountless/audit differentiation vs Mullvad.
When: You need enterprise zero-trust mesh or org-wide device VPN with SSO
Consider: Self-hosted WireGuard, Tailscale, or NetBird
Different product class than consumer privacy VPN.
When: You want open-source clients, a free tier option, and a privacy stack outside the Nord/Surfshark group
Consider: Proton VPN
Smaller device cap than Surfshark’s unlimited concurrent connections; stronger open-source posture.
When: You prioritize account-number privacy, minimal identity linkage, and a tunnel-focused product
Consider: Mullvad
Fewer lifestyle suite tools; different commercial and account model.
When: You want peer-reviewed AirVPN-style advanced networking features and a non-Nord ownership path
Consider: AirVPN
Different audience and ops model; check current catalog status and docs.
When: You already standardize on Nord products and only need another brand under the same holding
Consider: NordVPN
Sibling brand after 2022 merger — not ownership diversification.